Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We seem to have an issue running squid on our windows box. We are using NTLM to authenticate users on our active directory, but it seems t be 'slow' for users that are accessing it over the WAN. Users on the same subnet as the server seem to be ok.

We think it is an authentication issue because when we turn it off it starts to be a lot better. This is the section of the config that sets up the authentication -

#Authentication Params
auth_param ntlm program c:/squid/libexec/mswin_ntlm_auth.exe
auth_param ntlm children 50

# Programs to get the groups out for the user
external_acl_type win_domain_group ttl=120 %LOGIN c:/squid/libexec/mswin_check_lm_group.exe -G
external_acl_type win_local_group ttl=120 %LOGIN c:/squid/libexec/mswin_check_lm_group.exe

Anyone any ideas what might be going on? Looks like we are on version 2.7

Cheers Luke

share|improve this question
up vote 1 down vote accepted

NTLM will add a couple of roundtrips to each request - which will exacerbate any latency in a connection. Use kerberos instead if that suits your environment? Or digest auth?

share|improve this answer
what would the kerberos auth do differently than NTLM? – beakersoft Sep 24 '12 at 13:26
kerberos doesn't roundtrip, your client sends all that's needed in the first payload. – Tom Newton Sep 24 '12 at 13:27
that does sound better, ill give that a go. Also do you know if there is some sort of session keeo alive on squid, so the client wont re-authenticate each time a user connects? – beakersoft Sep 25 '12 at 8:04
No, not afaik. I work at Smoothwall, we use squid in our filter products, and I know we had to write additional software to do auth-n-run type schemes :) – Tom Newton Sep 26 '12 at 20:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.